OESA-2026-4856: gnome-shell security update
The GNOME Shell redefines user interactions with the GNOME desktop. In particular, it offers new paradigms for launching applications, accessing documents, and organizing open windows in GNOME. Later, it will introduce a new applets eco-system and offer new solutions for other desktop features, such as notifications and contacts management. The GNOME Shell is intended to replace functions handled by the GNOME Panel and by the window manager in previous versions of GNOME. The GNOME Shell has rich visual effects enabled by new graphical technologies. Security Fix(es):
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.(CVE-2026-91786)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/gnome-shellto a version that resolves this vulnerability.Fixed in 3.38.4-5.oe2203sp4
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the affected openEuler gnome-shell package are exposed when GNOME Shell processes icons supplied by a remote search provider over D-Bus. The provider may be malicious or compromised.
What does an attacker need to exploit the flaw?
The attacker needs the ability to supply icon data through a remote search provider that GNOME Shell processes via D-Bus. Exploitation also requires user interaction, as reflected by the UI:R vector.
What is the likely impact of successful exploitation?
A crafted icon with oversized declared dimensions can cause an out-of-bounds read in the GNOME Shell process. This may crash GNOME Shell and disrupt the user session, and could disclose sensitive data from adjacent memory.